RUSTSEC-2026-0448

    Dashboard / Vulnerabilities / RUSTSEC-2026-0448

    RUSTSEC-2026-0448

    Published: 6 Nov 2026Last Modified: 6 Nov 2026

    Summary: Unbounded decompression can exhaust memory and CPU resources

    Details: The `encoding::Decoder` stream can expand compressed input into a large output buffer before a caller can enforce its body size limit. An attacker who controls a compressed request or response can cause excessive memory allocation and CPU use, resulting in denial of service. This affects applications that decode untrusted gzip, deflate, Brotli, or Zstandard bodies with the corresponding compression feature enabled. Upgrade to actix-http 3.20.1 or later and configure `Decoder::limit()` when using the decoder directly. Actix Web users must also upgrade to actix-web 4.18.2 or later so that extractors pass their limits to the decoder.

    References: https://crates.io/crates/actix-http, https://rustsec.org/advisories/RUSTSEC-2026-0448.html, https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280

    Affected packages

    Package

    Name: actix-http

    Purl: pkg:cargo/actix-http

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -3.20.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2026-0448 | CVE-DB